Cannot generate SSL certificate upon initial setup

1. Caddy version (caddy version):

Caddy V2 latest Windows 10 64

2. How I run Caddy:

Running “caddy start” from Administrator Command Prompt with Caddyfile below

a. System environment:

Windows 10 Professional

b. Command:

caddy start

c. Service/unit/compose file:

N/A

d. My complete Caddyfile or JSON config:

{
email me@chewie.co.uk
}
home.chewie.co.uk {
reverse_proxy /radarr {
to 127.0.0.1:9797
}
}

3. The problem I’m having:

Caddy will not generate an SSL Certificate and I am unsure why. I have been using dynamic DNS as my provider for a long time and have no issues with accessing Radarr/Sonarr/NZB SSL login pages on my network from outside using SSL.

4. Error messages and/or full log output:

    C:\Caddy>2020/12/05 08:38:09.680        INFO    tls.obtain      lock acquired   {"identifier": "home.chewie.co.uk"}
    2020/12/05 08:38:09.700 INFO    tls.issuance.acme       waiting on internal rate limiter        {"identifiers": ["home.chewie.co.uk"]}
    2020/12/05 08:38:09.700 INFO    tls.issuance.acme       done waiting on internal rate limiter   {"identifiers": ["home.chewie.co.uk"]}
    2020/12/05 08:38:11.103 INFO    tls.issuance.acme.acme_client   trying to solve challenge       {"identifier": "home.chewie.co.uk", "challenge_type": "tls-alpn-01", "ca": "https://acme-v02.api.letsencrypt.org/directory"}
    2020/12/05 08:38:13.600 ERROR   tls.issuance.acme.acme_client   challenge failed        {"identifier": "home.chewie.co.uk", "challenge_type": "tls-alpn-01", "status_code": 403, "problem_type": "urn:ietf:params:acme:error:unauthorized", "error": "Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
    2020/12/05 08:38:13.601 ERROR   tls.issuance.acme.acme_client   validating authorization        {"identifier": "home.chewie.co.uk", "error": "authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge", "order": "https://acme-v02.api.letsencrypt.org/acme/order/105195964/6575055966", "attempt": 1, "max_attempts": 3}
    2020/12/05 08:38:15.040 INFO    tls.issuance.acme.acme_client   trying to solve challenge       {"identifier": "home.chewie.co.uk", "challenge_type": "http-01", "ca": "https://acme-v02.api.letsencrypt.org/directory"}
    2020/12/05 08:38:16.185 ERROR   tls.issuance.acme.acme_client   challenge failed        {"identifier": "home.chewie.co.uk", "challenge_type": "http-01", "status_code": 403, "problem_type": "urn:ietf:params:acme:error:unauthorized", "error": "Invalid response from http://home.chewie.co.uk/.well-known/acme-challenge/XpSuTDSBlsHCrE5XOpnQ24FAqp-S4VZH54AAxmyZWis [130.105.49.82]: \"<head>\\n<title>Error response</title>\\n</head>\\n<body>\\n<h1>Error response</h1>\\n<p>Error code 403.\\n<p>Message: Not Serving Client 66\""}
    2020/12/05 08:38:16.187 ERROR   tls.issuance.acme.acme_client   validating authorization        {"identifier": "home.chewie.co.uk", "error": "authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - Invalid response from http://home.chewie.co.uk/.well-known/acme-challenge/XpSuTDSBlsHCrE5XOpnQ24FAqp-S4VZH54AAxmyZWis [130.105.49.82]: \"<head>\\n<title>Error response</title>\\n</head>\\n<body>\\n<h1>Error response</h1>\\n<p>Error code 403.\\n<p>Message: Not Serving Client 66\"", "order": "https://acme-v02.api.letsencrypt.org/acme/order/105195964/6575056479", "attempt": 2, "max_attempts": 3}
    2020/12/05 08:38:17.836 ERROR   tls.obtain      will retry      {"error": "[home.chewie.co.uk] Obtain: [home.chewie.co.uk] solving challenges: home.chewie.co.uk: no solvers available for remaining challenges (configured=[http-01 tls-alpn-01] offered=[http-01 dns-01 tls-alpn-01] remaining=[dns-01]) (order=https://acme-v02.api.letsencrypt.org/acme/order/105195964/6575056814) (ca=https://acme-v02.api.letsencrypt.org/directory)", "attempt": 1, "retrying_in": 60, "elapsed": 8.154611, "max_duration": 2592000}
    caddy stop

5. What I already tried:

I have searched each error on Google but i cannot find anything that helps me with my specific issue. It seems at this stage Caddy should just work with me having ports 443 and 80 forwarded to the machine.

6. Links to relevant resources:

N/A

FYI request matching is exact-match, so that would only match exactly /radarr and not /radarr/foo. Use /radarr* instead. Also, you can make that a one-liner (don’t need the braces and to):

reverse_proxy /radarr* 127.0.0.1:9797

As for the ACME challenges, it seems that something else is handling the request and returning a 403. Are you sure that your DNS is properly configured to point to your home IP address?

Hi Francis,

Many thanks for the reply and the tip with the caddyfile, it makes sense.

In regards to something else handing the request, your message jogged my memory that I have PlexConnect running which uses port 443. I closed that down and then the certificate generated.

I appreciate the help, so far so good with both Sonarr and Radarr running.

1 Like

This topic was automatically closed after 30 days. New replies are no longer allowed.